CEH Interview Q&A (30 questions, SG-aware)

Scope. Thirty interview Q&A for jobs that cite CEH v13. Mix: 8 technical, 6 scenario, 5 legal/ethics, 4 behavioral, 3 culture-fit, 2 salary, 2 Singapore-specific. Each answer is a 3-6 sentence model you can deliver verbatim after light personalisation. Pair with research/08-career-market-and-comparison.md for SG salary bands and 01-resume-bullets.md for the resume angle.

Format rule. Each Q&A carries Category, Difficulty, the model answer, what the interviewer is actually testing, and bonus terms to drop for higher marks.

Section A - Technical (8)

Q1. Walk me through an Nmap scan you would run during a typical external penetration test.

Category: Technical · Difficulty: Easy Model answer: “I start with host discovery and a service-version sweep, never a raw -sS against the whole internet because it is loud and slow. My first command is usually nmap -sV -sC -O -Pn -T4 --top-ports 1000 -oA recon_<target> <CIDR> - service + script scan, OS guess, top 1,000 TCP ports. If the client has approved UDP, I follow with nmap -sU --top-ports 50 --max-retries 2 because DNS, SNMP, and NTP are the usual high-yield UDP services. I then move to targeted scans with --script=vuln on confirmed services and a full -p- only against the in-scope jump hosts. I always save outputs in -oA so I can diff against the next engagement.” What the interviewer is really testing: Whether you understand scan stealth vs thoroughness trade-offs and whether you keep evidence. Bonus points if you mention: Service version → CVE cross-reference, NSE scripting, scan-rate ethics, output normalisation (xml2json).

Category: Technical · Difficulty: Medium Model answer: “SQL injection happens when user input is concatenated into a SQL statement without parameterisation. To confirm blind SQLi, I inject a payload like ' to test for error, then AND 1=1 / AND 1=2 for boolean-based blind, and AND SLEEP(5) for time-based blind - each response delta confirms the injection even with no data returned. To exfiltrate, I use sqlmap -u '<url>' --batch --risk=2 --level=3 --dbms=<hint> --technique=BT (Boolean + Time) and pipe the dump through --file-write or --os-shell if the DB user has FILE privileges. Defenders fix it with parameterised queries / prepared statements plus a deny-list WAF as defence-in-depth.” What the interviewer is really testing: Real-world technique selection and remediation awareness. Bonus points if you mention: WAF bypass via comment chunking, second-order SQLi, out-of-band via DNS (LOAD_FILE), PDO/JPA parameterisation.

Q3. What is the difference between stored, reflected, and DOM-based XSS? Give one mitigation for each.

Category: Technical · Difficulty: Medium Model answer: “Reflected XSS bounces the payload off the server in the immediate HTTP response - classic phishing-vector, lower persistence. Stored XSS persists in the database (comment field, profile name) and fires for every future visitor - much higher impact. DOM-based XSS happens entirely client-side when JavaScript reads from location.hash or document.referrer and writes to innerHTML without sanitisation. The single fix that covers all three is context-aware output encoding plus Content Security Policy with script-src 'self' and no unsafe-inline. Input validation alone is necessary but not sufficient.” What the interviewer is really testing: Whether you can classify XSS by sink vs source, not just give a one-line definition. Bonus points if you mention: Trusted Types, httpOnly cookie flag, sink-specific encoding (HTML / JS / URL).

Q4. Describe a Man-in-the-Middle attack and one corporate control that prevents it.

Category: Technical · Difficulty: Medium Model answer: “A MitM sits between the victim and the legitimate endpoint, transparently reading or rewriting traffic. On a wired LAN the classic example is ARP poisoning with ettercap or bettercap - you spoof ARP replies so the victim sends traffic to your NIC, then forward it on while logging. On Wi-Fi, an evil-twin AP plus a stripped-down WPA2 handshake capture works the same way. The control that defeats both is certificate pinning (or full HSTS with preload) on the client, plus 802.1X with EAP-TLS on the network so the attacker cannot associate. Defence-in-depth also requires DNSSEC and DoH to take DNS off the table.” What the interviewer is really testing: Whether you understand L2 vs L7 MitM and that “use HTTPS” is not enough. Bonus points if you mention: SSL stripping (sslstrip), HSTS preload list, EAP-TLS, downgrade attacks.

Q5. Walk me through OWASP Top 10 (2021). What changed in the 2025 draft?

Category: Technical · Difficulty: Medium Model answer: “The 2021 list is A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable & Outdated Components, A07 Identification & Authentication Failures, A08 Software & Data Integrity Failures, A09 Security Logging & Monitoring Failures, A10 Server-Side Request Forgery. The 2025 draft (still candidate as of early 2026) is largely the same shape but adds an explicit emphasis on AI/LLM injection and software supply-chain compromise, both of which were absorbed into A03 and A08 in 2021. The biggest mental-shift between 2017 and 2021 was moving from ‘what is broken’ (XSS, SQLi) to ‘what was never designed safely’ - Insecure Design - and the 2025 list continues that arc.” What the interviewer is really testing: Whether you treat OWASP as a living document and understand the design-failure shift. Bonus points if you mention: OWASP API Security Top 10, OWASP MASVS (mobile), OWASP SAMM v2 for SDLC.

Q6. What is the cyber kill chain? How does it differ from MITRE ATT&CK?

Category: Technical · Difficulty: Easy Model answer: “Lockheed Martin’s Cyber Kill Chain is the 7-stage attacker view: Reconnaissance → Weaponisation → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. It is high-level, defender-oriented, and best for narrative reporting. MITRE ATT&CK is a much finer-grained adversary-behaviour matrix organised by tactic (the why) and technique (the how) - currently 14 tactics, hundreds of techniques, with real-world procedure examples. Practically, I use the kill chain to frame the executive narrative in a report and ATT&CK to map every observed technique (e.g. T1059.001 PowerShell, T1558.003 Kerberoasting) so defenders know exactly which detection to add.” What the interviewer is really testing: Whether you know when each framework is appropriate. Bonus points if you mention: ATT&CK Evaluations, sub-techniques, navigator layer, threat-informed defence.

Q7. Categorise three malware types and explain how you would contain each.

Category: Technical · Difficulty: Medium Model answer: “A worm self-propagates over the network (e.g. WannaCry via SMB) - containment is network segmentation + SMB patch + outbound firewall blocks. A trojan rides on a legitimate-looking payload (fake update, macro doc) - containment is EDR isolation of the host, revocation of any credentials touched, and a phishing-triage review of the delivery vector. A ransomware is essentially a trojan with a destructive payload - containment requires immediate host isolation, snapshot of the encrypted volumes for forensic recovery, and a credential-rotation sweep on every account the host could reach. For all three, I keep the volatile memory image (MemProcFS / AVML) before reboot because most EDR families lose in-memory indicators on power-off.” What the interviewer is really testing: Whether you can triage containment under pressure, not just classify. Bonus points if you mention: C2 beaconing analysis, Velociraptor hunt, immutable backup strategy (3-2-1-1-0).

Q8. Explain symmetric vs asymmetric cryptography. Where would you use each in a typical TLS handshake?

Category: Technical · Difficulty: Medium Model answer: “Symmetric (AES-GCM, ChaCha20) uses one shared key and is ~1,000× faster - ideal for bulk payload encryption. Asymmetric (RSA, ECDSA, Ed25519) uses a key pair and is computationally expensive - used only for authentication (signing the certificate) and key exchange (ECDHE derives a fresh symmetric session key). A modern TLS 1.3 handshake is: client hello → server hello + certificate + ECDHE parameters → client verifies cert chain → both derive the same AES-GCM session key via ECDHE → bulk traffic is encrypted symmetrically. Forward secrecy comes from the ephemeral ECDHE keys being discarded after the session, so a leaked long-term key cannot decrypt past sessions.” What the interviewer is really testing: Whether you understand why TLS uses both, not just that it does. Bonus points if you mention: Perfect forward secrecy, post-quantum (Kyber/ML-KEM in TLS 1.3 drafts), RSA vs ECDSA certificate sizes.

Section B - Scenario (6)

Q9. During a recon scan, you discover an open SSH port 22 on an in-scope server. What do you do next?

Category: Scenario · Difficulty: Medium Model answer: “I confirm the banner with nc -vn <ip> 22 and ssh -V against it, then run nmap -sV -p22 --script=ssh-auth-methods,ssh-hostkey to enumerate auth methods and the host-key algorithm (older SSH-1 / weak DH groups are immediate findings). If the client agreed to credential testing in the ROE, I attempt anonymous and default-credential login against a small wordlist (metasploit auxiliary/scanner/ssh/ssh_login) with low-and-slow throttling. Regardless of outcome, I document the finding category (Exposed Service, Weak Auth, Vulnerable Version) and move on - I do not start brute-forcing without explicit ROE approval because that crosses from reconnaissance into active exploitation.” What the interviewer is really testing: Whether you understand scope, authorisation, and audit trail. Bonus points if you mention: CBC-mode cipher downgrades, Terrapin attack (CVE-2023-48795), SSH jump-host pivot.

Q10. A client asks you to perform a penetration test. What is the very first deliverable you produce?

Category: Scenario · Difficulty: Easy Model answer: “The first deliverable is not a scan - it is the Rules of Engagement (ROE) document, signed by both the client’s CISO and the tester’s engagement lead. The ROE fixes scope (IPs / domains / cloud accounts / apps), window (start-end, business-hours vs 24/7), test type (black / grey / white-box), allowed techniques (DoS? social engineering? web app only?), data-handling rules, contact tree for critical findings, and an emergency-stop phone number. Without a signed ROE, anything you do is unauthorised and potentially criminal under Singapore’s Computer Misuse and Cybersecurity Act (CMCA). The kickoff deliverable I send after that is the scoping worksheet (assets, owners, success criteria).” What the interviewer is really testing: Whether you put legal/compliance before tooling. Bonus points if you mention: MAS TRM / Notice 658, NDA + liability caps, evidence-handling chain of custody.

Q11. You find an SQL injection that exposes 4 million customer NRICs. What do you do in the first hour?

Category: Scenario · Difficulty: Hard Model answer: “First, stop exploiting - I do not exfiltrate even one row to ‘prove’ impact; a screenshot of the database schema with the column name is sufficient proof. Second, notify the engagement lead and the client’s designated critical-finding contact within the SLA window (usually ≤ 1 hour). Third, document the request URL, parameter, payload, HTTP response, and timestamp; hash the evidence files for chain-of-custody. Fourth, the client engages their PDPA Data Breach Notification workflow - in SG, a breach affecting ≥ 500 individuals triggers mandatory notification to the PDPC and the affected individuals within 3 calendar days. My role at that point is to support the IR team, not to keep testing.” What the interviewer is really testing: Whether you understand regulated-data escalation and that “proof” must not become a second breach. Bonus points if you mention: PDPC breach notification timeline, IR retainers, evidence preservation order.

Q12. Your automated scanner flags 2,000+ findings on a single host. How do you triage?

Category: Scenario · Difficulty: Medium Model answer: “I sort by exploitability + business context, not by raw CVSS. First, I separate true positives from scanner noise by hand-validating the top 20% by CVSS, then dedupe by CVE/version. Second, I overlay business context - a medium-severity finding on a public-facing payment endpoint outranks a critical on an isolated dev VM. Third, I group by root cause (one bad Tomcat config often produces 30+ findings; fix the config, the findings disappear). The output is a risk-prioritised short-list of ≤ 30 actionable findings, with the rest filed as ‘accepted-risk backlog’ for the next remediation sprint. The job of a tester is to make the engineering team faster, not to drown them.” What the interviewer is really testing: Prioritisation, business context, and empathy for the dev team. Bonus points if you mention: EPSS (exploit prediction scoring), CISA KEV catalog, reachability analysis.

Q13. A user reports “my computer is acting weird.” Walk me through your triage.

Category: Scenario · Difficulty: Medium Model answer: “I treat this as a potential incident, not a helpdesk ticket, until proven otherwise. First 10 minutes: pull the host from the network (don’t power it off - volatile memory matters), capture a memory image with Velociraptor / AVML, then snapshot disk. Then I triage: check EDR for malicious processes, scheduled tasks, Run keys, recent file modifications, and any beaconing outbound. I cross-reference the user’s recent email + browser history with phishing-IOC lists. If I find a C2, I escalate to IR, pull network logs (proxy / DNS / NetFlow) for the past 7 days, and start the containment → eradication → recovery → lessons-learned cycle.” What the interviewer is really testing: Order of volatile evidence and the containment instinct. Bonus points if you mention: Chain of custody, memory-only malware (Fileless), LOLBins (rundll32, mshta).

Q14. During a red-team engagement, you gain domain admin. What do you do - and what do you not do?

Category: Scenario · Difficulty: Hard Model answer: “What I do: document the exact attack path (initial access → credential theft → lateral movement → DA), screenshot the DA proof without exposing more data than needed, and notify the engagement lead immediately per the critical-finding SLA. What I do not do: continue to exfiltrate, deploy ransomware as a ‘simulation’, touch production data, or call the client’s CISO directly - the ROE defines the communication channel. The engagement then enters a joint white-board session where I walk the blue team through the path so they can build detections. The lesson: red team value is in the replay, not the kill-chain trophy.” What the interviewer is really testing: Professional discipline and communication under success. Bonus points if you mention: Purple-team pivot, MITRE ATT&CK mapping of the path, detection-gap closure loop.

Section C - Legal / Ethics (5)

Q15. What is authorisation and why does it matter?

Category: Legal/Ethics · Difficulty: Easy Model answer: “Authorisation is the written, signed permission from the asset owner that defines what I am allowed to test, when, and against which targets. Without it, even passive reconnaissance of a Singapore company’s external IP can be a criminal offence under the Computer Misuse and Cybersecurity Act (CMCA) Sections 3-7 (unauthorised access, obstruction). In practice authorisation lives in three documents: the MSA / SOW (commercial scope), the NDA (data handling), and the Rules of Engagement (ROE) (technical scope). I never run a single packet without all three in place - and I keep them in the engagement folder for at least 3 years in case of post-engagement dispute.” What the interviewer is really testing: Whether you treat authorisation as a precondition, not a checkbox. Bonus points if you mention: CMCA Section 8A (abettor), cross-border authorisation (e.g. EU GDPR + SG PDPA), engagement insurance.

Q16. The Singapore Computer Misuse and Cybersecurity Act (CMCA) - what changed and what should a tester know?

Category: Legal/Ethics · Difficulty: Medium Model answer: “The CMCA was amended in 2017 and again in 2024 to criminalise the trading, possession, and dealing of hacking tools and credentials - so even teaching how to use Metasploit in a way that encourages unauthorised access can trigger Section 8A. The 2024 amendments also expanded extraterritorial reach - offences committed outside Singapore against Singapore persons or critical infrastructure are prosecutable here. For a CEH holder working in SG, this means: keep all lab work inside an isolated, owned VM with no Singapore-target assets; never run a tool against an in-scope client without the ROE in hand; and treat any ‘grey’ request as a hard no until the client produces written authorisation.” What the interviewer is really testing: Whether you stay current on local cybercrime law. Bonus points if you mention: CFAA (US), Computer Misuse Act 1990 (UK), MAS TRM on third-party risk.

Q17. A client asks you to test a system that is outside the original scope. How do you handle it?

Category: Legal/Ethics · Difficulty: Medium Model answer: “I do not test the out-of-scope asset, even if the requester is the same client contact who signed the ROE. Scope changes must go through a written change-order signed by an authorised signatory (usually the same person who signed the original ROE, or their delegate). The change order should specify the new asset, any new test window, any additional cost, and a re-confirmation of authorisation. Until that document is signed, the out-of-scope asset is treated as production - and if I accidentally discover a critical vulnerability on it during normal testing, I stop and notify without demonstrating or exploiting it. This is what ‘scope creep’ looks like, and it is the most common way engagements turn into legal disputes.” What the interviewer is really testing: Whether you can push back on a paying customer. Bonus points if you mention: Change-order template, dual-authorisation principle, evidence preservation if out-of-scope finding discovered.

Q18. What should be in a typical pentest NDA, and how does it differ from the ROE?

Category: Legal/Ethics · Difficulty: Medium Model answer: “The NDA is a confidentiality contract - it covers what I find, how long I retain it, who I can share it with, and what happens to the data after the engagement (secure-deletion certificate, return of evidence). The ROE is a technical authorisation document - it covers which assets I may test, which techniques I may use, and what to do if I find a critical issue. A common mistake is to sign only one and assume the other is covered. The NDA does not give me permission to test; the ROE does not give me permission to keep findings confidential. They are complementary, and a mature client signs both before kickoff.” What the interviewer is really testing: Whether you keep legal and technical documents distinct. Bonus points if you mention: Survival clauses, residual knowledge clauses, breach-notification timelines under PDPA.

Q19. What does a robust Rules of Engagement (ROE) document look like?

Category: Legal/Ethics · Difficulty: Hard Model answer: “A robust ROE has eight sections: (1) Scope - in-scope IPs, domains, cloud accounts, apps, and out-of-scope assets clearly listed; (2) Type - black, grey, or white-box; (3) Window - start/end dates, business-hours vs 24/7, any quiet-period exclusions; (4) Techniques - DoS allowed? Phishing? Physical? Cloud-only? Web-only?; (5) Data handling - what to do if production data is accessed (stop, notify, do not exfiltrate); (6) Critical-finding escalation - contacts, phone tree, SLA (typically ≤ 1 hr for critical); (7) Emergency stop - anyone on the client side can pause the engagement; (8) Signatures - engagement lead + client CISO. I have a template I reuse; my last client just signed it with zero redlines, which is the goal.” What the interviewer is really testing: Operational maturity and repeatability. Bonus points if you mention: Two-factor authorisation for scope changes, after-hours contact tree, evidence-destruction certificate.

Section D - Behavioral (4)

Q20. Describe a time you discovered a critical vulnerability. What did you do?

Category: Behavioral · Difficulty: Medium Model answer: Use the STAR format (Situation, Task, Action, Result) and pick a real engagement.

“Situation: I was leading a grey-box web + internal-network pentest for a Top-3 SG bank, 2 weeks into a 4-week engagement. Task: the goal was to find any path from a low-privilege employee account to a tier-1 customer-data store. Action: I noticed the bank’s internal Jenkins instance was exposed on a jump-host VLAN and was running an outdated plugin (CVE-2023-XXXXX, CVSS 9.8). I exploited it for proof-of-concept, immediately stopped, called the engagement lead and the bank’s CISO within 30 minutes per the ROE critical-finding SLA, and we jointly triaged the response. Result: the bank patched the Jenkins instance within 6 hours and rotated every credential the host could reach. They promoted my contract to a 12-month retainer and I later presented the anonymised case at BSides Singapore.” What the interviewer is really testing: Communication under success, compliance with ROE, and business value. Bonus points if you mention: Disclosure timeline, post-incident review, blue-team replay session.

Q21. Tell me about a time a test went sideways. How did you recover?

Category: Behavioral · Difficulty: Hard Model answer: Pick a real “oh no” moment - common ones: crashed a production service, exfiltrated customer data by accident, scanner triggered a customer-facing outage, found out the ROE was wrong.

“Situation: during an automated vulnerability scan I mis-typed a target IP and hit a production database cluster that was out of scope. Task: contain the damage and preserve client trust. Action: I killed the scanner within 90 seconds, documented the exact scan timestamps and target IPs, called the engagement lead who called the client’s on-call CISO, and we jointly audited the database for any read-impact - none, but I did not assume that, I helped them run the audit. Result: we agreed the root cause was my typo, not the ROE, and the client accepted a partial credit on the engagement. I added a two-person review of scan targets to my pre-flight checklist, and I have not repeated the mistake in [N] engagements since.” What the interviewer is really testing: Accountability and learning. Bonus points if you mention: Pre-flight checklist, peer review of scan targets, post-incident retro.

Q22. How do you handle a disagreement with a more senior tester about a finding’s severity?

Category: Behavioral · Difficulty: Medium Model answer: “I separate facts from opinion, then bring evidence. If the senior tester rates my finding lower, I show them the exact reproduction steps, the affected asset, the data classification, and any published exploit code or CISA KEV listing. If we still disagree after 15 minutes, I escalate to the engagement lead or the report QA reviewer - I never silently downgrade a finding because the client wants it gone, and I never silently upgrade it because I want to look thorough. The final report carries the lead’s decision, but I keep a personal note of the disagreement for my own learning. The goal is consistency across the team, not winning the argument.” What the interviewer is really testing: Professional maturity and report integrity. Bonus points if you mention: Peer-review process, CVSS vs business-context scoring, escalation path.

Q23. Describe a time you explained a technical vulnerability to a non-technical stakeholder.

Category: Behavioral · Difficulty: Medium Model answer: Pick a board, audit-committee, or business-owner audience.

“I was presenting pentest findings to the audit committee of an SG-listed company, none of whom had a technical background. I had 15 minutes. I opened with a one-sentence business-impact statement (‘an attacker could read every customer’s NRIC and credit-card last-four from your customer portal’), then walked the committee through the attack path as a story - someone clicks a phishing email, their laptop joins the attacker, the attacker walks sideways to the customer database. I showed two screenshots: the phishing email and the database row. I closed with a remediation cost of S$45K vs an estimated breach cost of S$4M, which the CFO asked me to repeat. The board approved the remediation budget in the same meeting.” What the interviewer is really testing: Translation skill and respect for the audience. Bonus points if you mention: Pyramid Principle, financial-quantification, executive summary template.

Section E - Culture Fit (3)

Q24. How do you keep up with new threats and vulnerabilities?

Category: Culture-fit · Difficulty: Easy Model answer: “I run a daily 30-minute routine: CISA KEV catalog for must-patch-now, The Hacker News / Bleeping Computer for narrative, and @vxunderground / @CVEnew on X for fresh CVEs. Weekly: SANS Internet Storm Center diary and FIRST EPSS refresh. Monthly: read the MITRE ATT&CK changelog and skim the latest Verizon DBIR. I keep a personal Obsidian vault with a note per technique and link back to engagements where I saw it used. I also run a small home lab (1 Hyper-V host + 2 VMs) where I reproduce any interesting CVE within 48 hours of disclosure. Time-boxing matters - endless scrolling Twitter is not learning.” What the interviewer is really testing: Sustainable habit, not heroics. Bonus points if you mention: Personal blog, BSidesSg/DefCon attendance, blue-team vs red-team reading balance.

Q25. How do you balance offensive testing with respect for production stability?

Category: Culture-fit · Difficulty: Medium Model answer: “Three rules. First, the ROE explicitly carves out production-stability protections - no DoS, no high-port-rate scans against production during business hours, and a kill-switch phone number anyone can use. Second, I always run a canary asset - a non-critical server the client has designated as the canary - so I can validate my tooling before pointing it at production. Third, every active test is time-boxed and logged; if I touch production data by accident, I stop, notify, and help with the audit rather than continuing. The job of a pentester is to find risk without becoming the risk.” What the interviewer is really testing: Whether you treat the client’s production like your own. Bonus points if you mention: Canary asset, throttled scans, evidence-of-impact screenshots vs live exploitation.

Q26. Why do you want to work in offensive security specifically - and what would you do if you could not?

Category: Culture-fit · Difficulty: Medium Model answer: “Offensive work appeals because it is the shortest feedback loop in security - you either get a shell or you do not, and the lesson is concrete. I also enjoy the builder mindset: every report I write becomes a ticket that hardens a real system. If I could not work in offensive security, I would go to detection engineering - the blue-team mirror of the same work, where you write the rules that catch the techniques I would have used. I have done both and I think the best offensive testers have at least 12 months of blue-team or engineering behind them; it is what makes a pentest report useful rather than just impressive.” What the interviewer is really testing: Long-term motivation and humility. Bonus points if you mention: Continuous learning, purple-team philosophy, willingness to do defensive work.

Section F - Salary / Expectation (2, SG context)

Q27. What are your salary expectations?

Category: Salary · Difficulty: Medium Model answer: “Based on the PayScale SG 2025-2026 data for a CEH holder (S$75K median base) and the Craw Security SG role-based bands - pentester S$60K-S$108K, senior ethical hacker S$90K-S$150K - my target for a [role level] position in Singapore is S$[X] base + variable, with a re-evaluation at the 12-month mark tied to OSCP or CPTS completion. I am open on total comp structure - I care more about the work, the team, and the training budget than the headline number. Happy to walk through the comp breakdown once you have shared the band for this role.” What the interviewer is really testing: Whether you have done your homework on SG bands and whether you anchor in data, not vibes. Bonus points if you mention: SSG-funded training budget, cert-renewal support, conference travel, variable component tied to finding quality.

Q28. Are you open to a contract vs permanent role? What about shift work?

Category: Salary · Difficulty: Easy Model answer: “Open to both - for the right team I would start on a 6-month contract-to-permanent so we both have an off-ramp. I am also open to shift work for SOC roles (24×7 follow-the-sun), with a shift differential of 10-15 % being the SG market norm. For red-team engagements, I expect on-call availability during the engagement window, with a documented rota if the engagement is multi-week. I am based in Singapore, so no relocation cost; if the role requires travel within SEA, I am happy to travel up to ~30 % of the time.” What the interviewer is really testing: Flexibility vs exploitable eagerness. Bonus points if you mention: Shift differential norm, EP / S-Pass constraints, willingness to mentor junior testers.

Section G - Singapore-Specific (2)

Q29. How would you use the CSA / IMDA / SkillsFuture ecosystem as a CEH holder in Singapore?

Category: Singapore-Specific · Difficulty: Medium Model answer: “Three concrete moves. First, I would use SkillsFuture Credit (S$500) + the SSG course directory (CEH v13 is on TGS-2025054742) to fund the CEH cert at net S$0-S$310 for a Singapore Citizen aged 25+ - and the Mid-Career Enhanced Subsidy (MCES) drops it further to ~S$317 if I am aged 40+. Second, I would consider the CSA Cybersecurity Development Programme (CSDP) at Ngee Ann Polytechnic if I am early-career - it stacks CEH + CEH Masters + SUTD ModularMaster and is a direct path into a public-sector cyber role. Third, I would target the IMDA TechSkills Accelerator (TeSA) mid-career pathway if I am switching from another tech discipline - it co-funds CEH + an attached attachment with a Singapore employer. The SkillsFuture ecosystem is a real cost advantage vs my peers in HK or Sydney.” What the interviewer is really testing: Whether you actually live here and know the funding landscape. Bonus points if you mention: SFEC (S$10K employer credit), CEH Practical SSG subsidy, CITREP+ for mid-career switchers.

Q30. What is IM8 and how does it affect a pentest engagement for a Singapore government agency?

Category: Singapore-Specific · Difficulty: Hard Model answer: “IM8 (Instructional Manual 8) is the whole-of-government secure-by-deployment policy issued by CSA, last refreshed in 2024. For a pentester, IM8 affects three things. First, the authorisation chain - any test against a government agency requires not just the agency’s CISO sign-off but also CSA notification for critical-infrastructure systems. Second, the data-handling rules - any artefact that touches government data (screenshots, dumps, memory images) must be encrypted at rest with approved cryptographic modules (typically AES-256-GCM via FIPS 140-3 or equivalent) and stored on GovTech-issued encrypted laptops with no cloud sync. Third, the reporting cadence - critical findings must be reported to the agency and CSA within the SLA window, and the agency has 24 hours to acknowledge. I have read the IM8 secure-deployment annex; my last government engagement took 3 weeks just in pre-engagement paperwork, which is normal.” What the interviewer is really testing: Whether you can work inside Singapore’s public-sector security regime. Bonus points if you mention: CSA Cyber Secure Singapore portal, MAS TRM, GovTech’s STACS approval, secure-by-design vs secure-by-deployment distinction.

Quick-fire Cheat Sheet (for end-of-interview recap)

CEH v13 syllabus highlight: 20 modules including AI threats, IoT/OT, cloud, container escapes.
Most-asked technical: Nmap flags, OWASP Top 10, kill chain, XSS categories, MitM prevention.
Most-asked ethics: CMCA, ROE, scope creep, NDA, critical-finding escalation.
Most-asked scenario: open port → next step, scanner noise → triage, prod hit → IR.
Salary band in SG (2026): Junior S$42-60K, Mid S$60-108K, Senior S$90-150K, Principal S$120-300K+.
Singapore-specific: SSG / SkillsFuture funding, CSA CSDP, IM8, MAS TRM, PDPA breach notification.

Sources

Singapore salary bands, employer list, CSA / SSG / IM8 references: research/08-career-market-and-comparison.md (PayScale SG, Craw Security SG, EC-Council 2025 Hall of Fame, CSA CSDP, SSG course directory, MAS Notice 658, MAS TRM).
CEH v13 syllabus structure (20 modules, 4h MCQ, optional 6h Practical) and exam logistics: EC-Council CEH v13 program page (https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh/).
CMCA Sections 3-7, 8A, and 2024 amendments: Singapore Statutes s.50A (Computer Misuse and Cybersecurity Act), as amended; cross-referenced with MAS TRM (Technology Risk Management Guidelines).
OWASP Top 10 (2021 and 2025 candidate): https://owasp.org/Top10/.
MITRE ATT&CK v14+: https://attack.mitre.org/.
NIST SP 800-115 (Technical Guide to Information Security Testing & Assessment).